3 Commits

Include renames

Author	SHA1	Message	Date
jakman85andClaude Opus 4.8	275ac466b2	wire Cloudflare DNS token secrets + exempt *.sops.yaml from yamllint ... - Rename the committed encrypted secrets to canonical cloudflare-api-token.sops.yaml (cert-manager + external-dns namespaces) and uncomment the resource lines in both kustomizations, so cert-manager DNS-01 + ExternalDNS get the token at reconcile. - Exempt **/*.sops.yaml from ci/yamllint.yaml: SOPS re-emits encrypted files with its own indentation + long ENC[...] lines (never hand-edited), which was failing the lint gate on main after the secrets were committed. Same treatment as **/vault.yml. Both Secrets confirmed present + encrypted in the platform build; gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-08-17 00:35:45 -05:00
jakman85andClaude Opus 4.8	a108d5ab98	correction: credential-forward + unified graph; activate SOPS (author-first) ... Operator directive: don't diverge architecture to avoid asking for credentials; provision them upfront via SOPS and keep the existing (unified) graph. Roadmap reconciliation: Phase 2 = Network/Storage/TLS/DNS/Ingress, so cert-manager/externaldns/gateway (the credential-gated pieces) ARE Phase 2; monitoring is Phase 4. Earlier A2/rollout scope was inverted by credential-avoidance. Reverts (credential-driven): remove clusters/dev/rollout/ + the $patch:delete's; restore unified base graph (dev = ../base + cluster-vars + SOPS decryption, R-ENV-02 intact); restore monitoring files (Phase 4). Kept non-credential improvements: tofu for_each/rejoin, Kyverno parametrization + webhook excludes. platform/kustomization.yaml now phased (single shared list): Phase-2 set = kyverno, cilium, longhorn, cert-manager, externaldns, gateway; later components commented with phase markers. SOPS activated: .sops.yaml at repo root; bootstrap/sops/secret-templates/*.yaml.example for all secrets (cloudflare x2, grafana, alertmanager-smtp, keycloak, oauth2-proxy, pia); bootstrap/sops/CREDENTIALS.md checklist; pre-wired commented cloudflare-api-token lines in cert-manager + externaldns; filled non-secret ACME email. Agents never touch real secret values (operator encrypts). Validated: kubectl kustomize dev(unified)/prod/platform(Phase-2 only), templates inert, make -C ci gate PASS. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-08-16 22:09:20 -05:00
jakman85andClaude Opus 4.8	af4f6c07ae	T-0.1 Flux GitOps layout + dev/prod overlays + platform component skeletons (R-GITOPS-01/03, R-ENV-02, R-PLAT-01) ... Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>	2026-08-16 00:08:31 -05:00